Oikos Week 1: kernel policy, ontology, service contract, topology gen

Adds the Oikos agent-OS kernel: oikos/policy.yaml (risk classes +
approval rules for every homelab/MCP command), oikos/ontology.yaml
(8-domain systems model, typed relationships, node lifecycle), and
OIKOS.md (OODA loop operating brief, linked from AGENTS.md).

Extends inventory.yaml with a stable service contract (doc_page,
config_repo, risk_notes) on all 17 services, and a structured
archaeology: section for the 13 destroyed LXCs (was scattered
comments + a narrative table). Fixes stale drift found in the
process: authentik's backend pointed at a retired LXC (124); core
has run on the VPS since 2026-05-31.

Adds oikos/gen-topology.py, generating infrastructure/topology.md
(Mermaid compute/ingress + storage views) from inventory.yaml.
build_host_files.py now carries state/storage/depends_on into
generated hosts/*.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/netbird-vps.yaml

@@ -5,6 +5,7 @@ name: netbird-vps
 kind: external
 os: linux
 role: netbird-mgmt
+state: active
 mesh:
   netbird:
     ip: 100.122.165.149
@@ -16,6 +17,16 @@ mesh_globals:
   - tailscale
 ssh:
   user: root
+runs:
+- authentik
+services_hosted:
+- name: authentik
+  url: https://auth.hubris.network
+  backend: netbird-vps
+  doc_page: containers/106-auth-outpost.md
+  note: core runs on the VPS since 2026-05-31; LAN forward-auth outpost is auth-outpost (LXC 106) at 192.168.8.6:9000.
+    Previous backend value "authentik" referenced the retired embedded-outpost host (LXC 124).
+  risk_notes: "SSO provider \u2014 outage locks login to OIDC/forward-auth services"
 notes:
 - "Public IONOS VPS \u2014 hosts the vanilla netbird mgmt+signal+relay+dashboard stack + host coturn (see\
   \ infrastructure/vps-hardening.md + infrastructure/mesh.md changelog 2026-05-21)."